The phrase "from scratch" was originally a sports analogy meaning from the starting line, like a footrace, or a facing line like in boxing. A line in chalk was scratched into the ground. So in this case it means from the beginning, which even using AI, it is. The boxers come to the ring to fight from scratch, but they've had years of training and watched countless boxing matches to learn. Both the CentOS creator and the AI agent have learned immense amounts of information from a lot of other people's open source work, but they started making a new OS from the beginning or the scratch line.

That one flew over your head huh?https://youtu.be/lOfZLb33uCg

Think you're really righteous? Think you're pure in heart? Well, I know I'm a million times as humble as thou art I'm the pious guy the little Amlettes wanna be like On my knees day and night, scorin' points for the afterlife So don't be vain and don't be whiny Or else, my brother, I might have to get medieval on your Heinie!

Indeed, but if you want to be a VP at Meta you need to be absolutely ruthless, cut-throat and act without any sense of empathy to further the company's interest. All the while creating a social media persona of this successful thought leader who is an amazing person to work for. (Cough Sheryl Sandberg and her "lean in" nonsense they doesn't work for non-super-rich people). The type of person that would make Machiavelli blush. By the time the Streisand effect hits you're set for life and don't care anymore (cough, Sandberg).

I am not aware that anyone subsidizes my Internet usage in Silicon Valley on a full-price (non low income) circuit. It's still running over old DOCSIS coax connectivity people paying for cable subscriptions in the 80s already provided plenty of profit to the corporations for installing the cables. The average US household uses about 737gb a month, so 1TB isn't a huge difference either. Europeans use less but it's projected to average 900gb by 2030. That's fifty bucks a month with this new French tax.

I'm genuinely curious then, as a Slashdotter and likely someone working in tech, how do you plan to obtain an income after moving?

Just because france lags behind by a few years, doesn't mean the change you loathe isn't coming there too. Sounds like you haven't heard of the France 2030 initiative: https://economyglobal.com/news...

or the self driving car/self driving cab initiative: https://www.electrive.com/2026...

Sounds like you're moving to retire rather than find tech work, in which case the crushing French capital gains tax will eat into your budget if you plan to live off investment income.

A TB adds up to about 30 hours of 4k streaming plus regular Internet usage (email, smartphone apps, web browsing, downloading the occasional ISO or LLM for local usage etc). That's not COVID era couch potato level that's watching a one hour show nightly. Or a couple hours some weekday evenings and nothing on the weekends. As I mentioned, companies are highly unlikely to just eat the cost (as this would mean a major product reduction and drop in company value/stock price) and this means higher ISP, mobile data and subscription costs. The proof is in the pudding, here in Silicon Valley there are over 600 French startups with a major presence. If France was so conducive and awesome why are French tech companies like Front hiring most of their employees in the US and a small fraction in France, or in the case of french-founder unicorn Checkr nearly zero? Taxes like this are sure to perpetuate the trend.

On my (USA) connection I average about a TB a month, and I'm not even a crazy gamer/high utilization user. That would mean a tax of approx 60 USD a month. That tax would be most of what I pay my ISP. Corporations aren't going to eat this, they're going to pass it on to the consumer. Considering France's astronomical tax rate already (up to 50 percent employer cost on top of salary), this is sure to increase cost for tech companies ...to the point where headquartering and hiring elsewhere becomes competitively necessary. Can they think of ways to raise revenue by growing their economy instead of shrinking the economy and passing on crushing taxes to the average person watching streaming video?

So, you (incorrectly) complain about a strawman attack, and of my command of English, but you actually said:

So, in the comment above, you literally said the thing verbatim you claimed not to say in this comment.

You've gone from insults (some of which you've walked back by conceding my infosec knowledge), to pitiful attempts to display a degree of infosec knowledge, to denials of verbatim text you've said in the parent comment. You then moved onto staking that your opinion rests on an unlikely, unfalsifiable scenario where a threat actor uses an exploit and remains undetected well past a low-severity patching window (six months), and well beyond industry-standard undetected "dwell time," which in 2026 is 14 days.

I would pinpoint your projection of "a lack of basic reasoning skills" to be exemplified by your false identification of a strawman attack here. Perhaps it's time you took a college class on logic and the nature of logical fallacies, before using the term "strawman" to refute an argument which in fact hinges on the exact language and logical premise you used.

It is rather ironic you talk about "reasoning skills and grasp of the English language..." but you supply a completely fabricated and incorrect definition of a successful exploit. A successful exploit is not one that cannot be detected. It is simply one that obtains access or privilege escalation. It is often not even the exploit itself that gets detected, it is the behavior associated with the hacker's activity after exploitation that is detected..e.g., modifiying system files to obtain persistence, exfiltrating data, anomalous activity patterns, and so forth.

Reference link

Aside from attacks from nation-state actors to obtain persistent feeds of intelligence and information, the vast majority of successful exploits are made with the threat actor actively wanting to announce the hack. This can be the case of ransomware (exploit happens, data encrypted/exfiltrated, ransom demanded..making the breach known), hackers doing it for the lulz (some of the recent ShinyHunters hacks, go read Krebs for more information), or those using those systems for malicious purposes such as spam, malware distribution, bitcoin mining etc, which are short-term gains the threat actor knows will eventually be detected and shut off.
Often, anomalous activity after the successful exploitation causes the compromise to become detected.

You have redefined "successful exploit" with your arbitrary definition which conveniently creates a boogeyman of this hidden threat actor that stays latent/persistent for a long term period without making their presence known or using their hacked access for any personal gain. Outside of intelligence/nation-state actors, this makes zero sense. Hacks are usually conducted with the intent of the victim eventually knowing about it so the threat actor can obtain some sort of monetary gain.

I suggest you consult a dictionary or actually google the term "successful exploit" before coming up with more word salad nonsense. This is again why I'm confident you couldn't pass any security certification exam, in addition to your outdated knowledge (thinking it's possible to succeed with an EPS32 etc implant in a datacenter, without factoring difficulty of C&C and exfiltration..perhaps you've never heard of a Bastille Networks or similar WIDS monitoring RF/5G/4g etc for exfiltration, as is present at most commercial datacenters); you're also arrogant enough to come up with your own definitions which are patently wrong.

Your grasp of information security is beyond subpar. See you in six months when there's no reported use of this exploit.

Or somebody downloaded an export file/csv and sent it to the wrong place or put it on a compromised device. Gee, a user listing from Okta. I think you could get most of that info searching LinkedIn.

I set a timer to deploy an AI agent to search to see if there's any record/information about this vulnerability being successfully exploited and causing a real breach (outside of a lab/test environment). Then necro this thread in six months.

You tried to use your highly limited knowledge to prove me wrong, but got your ass handed to you because you don't know what you're talking about. Rather than respond to my factual statements, you've reverted to schoolboy style insults again because that's where you feel safe and can maintain your air of arrogance and superiority, and avoid the cognitive dissonance of actually digesting my response and realizing you're dead wrong. Now I see where your demeanor comes from: you're unconfident in your technical knowledge (and should be) and prefer to degrade others on Slashdot, because that's far easier than actually knowing about infosec/tech in general and being able to defend your (shoddy, unrealistic) points.

Again, you're operating at a junior-analyst level of security knowledge. I've seen better from community college students.

1. That means its presence on a secure management network, which is probably (and should be) highly restricted and/or requires authentication e.g. like 802.1AE or Cisco MACSEC. That management network also probably has a NIDS on it, so plugging in such a device generating ICMP traffic will get it flagged in no time. Since almost all datacenters have complete, redundant camera coverage, identifying the person who planted such a device would be trivial. Did you advise the Saudi OpenAI employee who tried this in a conference room and now sits in a jail cell?

2. True, but it has to evade detection until a very short exploit window emerges, and avoid detection as the process to try to implant malware etc will make the server reboot take significantly longer.

3. This vulnerability isn't exploited by a boot USB, and no one said that (see: your reading comprehension problems), it was merely to illustrate the same level of privileged access can be used to execute a much easier hack not reliant upon this vulnerability. Note it also doesn't require the "skills" you describe, as the same remote C&C infrastructure your scenario depends upon can be used via a USB-style attack through the addition of a console plug.

4. The vulnerability above requires significant skills to exploit, at or above the level you describe for the boot USB, as it also requires you to implant your own malware at the time. Kali Linux is also not a USB-based "tool," it's a Linux distribution with a number of hacking tools pre-installed. Since you're so persnickety about grammar, it's quite ironic to see you make such a fundamental mistake which betrays your lack of knowledge on security tooling. In addition, the console is usually near the server in all except the largest datacenter environments, and even then it would be similar in location to the nearest switch one could patch into; again, on camera.

Secure Datacenter means a lot because those persons would be logged, subject to going through a man-trap, and on camera the entire time. It also requires the threat actor to be one of the personnel with such access, which also is a significant mitigating factor lowering the residual risk as I've described.

You also propose an EPS32 or similar device (perhaps a Hak5 Shark Jack?). That requires remote C&C capability. Typically management networks do not even have egress to the internet, as they don't need it, and in the rare instances they do they go across a gateway [NAT device/firewall/etc), which should also have NIDS on it. The C&C activity from a management network will again, be flagged in no time. Datacenters act as a faraday cage and traditional methods of out of band data exfiltration won't work, such as 5G connectivity to external cellphone antennas, or radio-frequency egress.

You've taken pains to create a word salad that might sound plausible to someone who isn't a professional, but this is laughable n00b talk; riddled with mistakes and false assumptions. Exploitation of this vulnerability on servers in a datacenter environment is extremely difficult and requires personnel with privileged access to even initiate, on top of the difficulty of remote C&C.

Your answer also reads like you stopped learning about InfoSec sometime in 2012, but with you spouting nonsense like this, I suspect you'd fail the entry-level Security+ and probably get booted out of the mid-level CISSP around question 40.